V8 correctness failure in configs: x64,fullcode:x64,ignition_staging |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5104896799145984 Fuzzer: foozzie_js_mutation Job Type: foozzie_ignition_staging Platform Id: linux Crash Type: V8 correctness failure Crash Address: Crash State: configs: x64,fullcode:x64,ignition_staging sources: 1a6 Sanitizer: address (ASAN) Regressed: V8: r42370:42371 Minimized Testcase (0.38 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96yjPKq57PoedWNLDuHr1S-tlNMf89BeGho_eHgd6db7YqLgnGb7_sP0M_bwXKl5qOwKuAs90aXtlnhTTZ4AOOudaVjBnoUj9HLKKkUdPR2JcjJeCgDmm1AHUl66nSNzzZakCguivqHHDIRGHaly-GPdtm8YVGcjA9iTEKLdrXEwdw4Aw4JCeB-MiPPuY0EGIPMyAvATvy8Mbzg8I5UqvVKDq1oXk-Nvr5yAHzK0w8FcoI5oBg6g-Lofd4mQXSKuGnlCGrT-aZFTqTu2z1s7bLC2LU2rKpatB14odSaiUUZH4nRCs4_Pmi5e6T1xjnpkfD3UEGf5VT_DvRbZbMyJxTRTZ-KGg0a1Tt_QsOEr2IQZ5-Kd2I?testcase_id=5104896799145984 switch (typeof value) { } assertEquals = function assertEquals(expected, found) { print(found); }; var __v_3 = {}; __v_0 = (1 - Math.pow(2,-53)); print("v8-foozzie source: /v8/test/mjsunit/compiler/rotate.js"); function __f_16(x, sa) { return (x >>> sa) | (x << (32 - sa)); } __f_16(0, -2147483648); %OptimizeFunctionOnNextCall(__f_16); assertEquals(__v_3 % 32, __f_16(1.4, __v_0)); Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jan 18 2017
This seems to be a Crankshaft issues, but only if feedback is collected by Ignition.
,
Jan 20 2017
As discussed, moving to machenbach@ for further triage.
,
Mar 8 2017
ClusterFuzz has detected this issue as fixed in range 43654:43655. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5104896799145984 Fuzzer: foozzie_js_mutation Job Type: foozzie_ignition_staging Platform Id: linux Crash Type: V8 correctness failure Crash Address: Crash State: configs: x64,fullcode:x64,ignition_staging sources: 1a6 Sanitizer: address (ASAN) Regressed: V8: 42370:42371 Fixed: V8: 43654:43655 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96yjPKq57PoedWNLDuHr1S-tlNMf89BeGho_eHgd6db7YqLgnGb7_sP0M_bwXKl5qOwKuAs90aXtlnhTTZ4AOOudaVjBnoUj9HLKKkUdPR2JcjJeCgDmm1AHUl66nSNzzZakCguivqHHDIRGHaly-GPdtm8YVGcjA9iTEKLdrXEwdw4Aw4JCeB-MiPPuY0EGIPMyAvATvy8Mbzg8I5UqvVKDq1oXk-Nvr5yAHzK0w8FcoI5oBg6g-Lofd4mQXSKuGnlCGrT-aZFTqTu2z1s7bLC2LU2rKpatB14odSaiUUZH4nRCs4_Pmi5e6T1xjnpkfD3UEGf5VT_DvRbZbMyJxTRTZ-KGg0a1Tt_QsOEr2IQZ5-Kd2I?testcase_id=5104896799145984 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 8 2017
ClusterFuzz testcase 5104896799145984 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Mar 8 2017
,
Mar 10 2017
,
Sep 18 2017
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by machenb...@chromium.org
, Jan 18 2017Labels: v8-foozzie-failure
# PTAL! Calling with or without --ignition-staging is enough (and --allow-natives-syntax). Simple repro: function foo(x, sa) { print((x >>> sa) | (x << (32 - sa))) } foo(0, -2147483648); %OptimizeFunctionOnNextCall(foo); foo(1, 0.99); # Difference: - -2147483647 + 1